gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,302 Commits 12 Branches 481 Tags 2.4 GiB
e795141fba
Commit Graph

9143 Commits

Author SHA1 Message Date
Michal Čihař
155876b48f Merge pull request #20 from phpmyadmin/xss-host 
Urlencode hostname
 2016-02-25 11:57:24 +01:00
Michal Čihař
45ecc10d18 Avoid skipping the SSL certificate check in TCPDF 
This code is never used in phpMyAdmin, but we fix it just to avoid
potential security reports.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 10:29:26 +01:00
Michal Čihař
73c8245a3d Urlencode hostname 
This can come from the HTTP header, so we need to be sure to sanitize
it.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 09:57:29 +01:00
Isaac Bennetch
945c58b9d2 Release 4.0.10.14 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-01-29 09:49:22 -05:00
Michal Čihař
bf2fde282e Merge pull request #11893 from madhuracj/bug11891 
Fix #11891 Error with PMA 4.0.10.13 with PHP 5.2
 2016-01-28 15:04:19 +01:00
Michal Čihař
c1377f30a2 Define missing queries in the dummy driver 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:33:37 +01:00
Madhura Jayaratne
555e73f177 Fix #11891 Error with PMA 4.0.10.13 with PHP 5.2 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-01-28 22:08:02 +11:00
Isaac Bennetch
16136ea0ef Increment version for 4.0.10.13 release 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-01-27 21:30:00 -05:00
Michal Čihař
5b79467245 Enable localization before redirect 
This is needed in case of IIS which needs full HTML response.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-27 08:55:07 +01:00
Michal Čihař
25738352df Fallback to default collation connection 
If user supplied wrong string we should gracefully fallback.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-26 15:05:42 +01:00
Michal Čihař
7056ca9458 Do not process subforms with PMA_MINIMUM_COMMON 
In such case needed infrastructure is not loaded, so related code won't
work anyway.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-26 14:34:01 +01:00
Michal Čihař
8023340a25 Include common libraries in setup 
We use PMA_fatalError which in turn needs Response and related objects.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-26 14:25:57 +01:00
Michal Čihař
fe62b69a5b Use hash_equals for comparing token 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-26 13:00:50 +01:00
Madhura Jayaratne
27eb98faed Escape javascript variable content 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-01-26 22:21:24 +11:00
Michal Čihař
6fe54dfa00 Use phpseclib's Crypt::Random to generate CSRF token 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-26 09:51:12 +01:00
Madhura Jayaratne
0ce4fd2750 Fix XSS in DB_search.php 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-01-19 21:01:32 +11:00
Madhura Jayaratne
9f3488fc3a Fix XSS in zoom search 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-01-19 20:59:37 +11:00
Marc Delisle
66149607b1 4.0.10.12 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-12-25 15:25:34 -05:00
Marc Delisle
f79d30dd98 [Security] Path disclosure, see PMASA-2015-6 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-12-25 15:24:18 -05:00
Marc Delisle
2694c36ef6 4.0.10.11 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-09-23 07:00:32 -04:00
Madhura Jayaratne
9730b16dd0 issue #11464 phpMyAdmin suggests upgrading to newer version not usable on that system 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-09-22 23:59:20 +10:00
Marc Delisle
d81165f345 4.0.10.10 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-05-13 11:06:36 -04:00
Madhura Jayaratne
e97e7fb0ea bug #4900 [security] Vulnerability allowing Man-in-the-middle attack 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-05-13 07:32:02 +05:30
Madhura Jayaratne
fea1d39fef bug #4899 [security] CSRF vulnerability in setup 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-05-12 19:56:53 +05:30
Marc Delisle
a395665715 4.0.10.9 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-03-04 10:34:18 -05:00
Marc Delisle
e1a68ad02c bug [security] Risk of BREACH attack 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-03-04 10:32:07 -05:00
Marc Delisle
5004dc4098 4.0.10.8 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-01-07 08:10:02 -05:00
Ian P. Christian
394bf9183c Support early versions of PHP5.2 (register_shutdown_function) 
Signed-off-by: Ian P. Christian <ichristian@users.sf.net>
 2015-01-07 08:03:09 -05:00
Ian P. Christian
9b7fbe29ce Recursive function too deep 
Signed-off-by: Ian P. Christian <ichristian@users.sf.net>
 2015-01-07 07:52:29 -05:00
Marc Delisle
00828f9ccb 4.0.10.7 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-12-03 07:55:56 -05:00
Madhura Jayaratne
095729d812 bug #4611 [security] DOS attack with long passwords 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-12-01 20:49:45 +05:30
Marc Delisle
13a288d0da 4.0.10.6 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-11-20 10:09:42 -05:00
Madhura Jayaratne
c7685e5acd bug #4597 [security] XSS through pma_fontsize cookie 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-18 10:15:34 +05:30
Madhura Jayaratne
c5783321cd bug #4598 [security] XSS in multi submit 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-17 12:13:09 +05:30
Madhura Jayaratne
2e3f0b9457 bug #4594 [security] Path traversal in file inclusion of GIS factory 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-17 11:03:55 +05:30
Marc Delisle
d0f7dc7990 4.0.10.5 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-10-21 10:07:51 -04:00
Madhura Jayaratne
57594febab bug #4562 [security] XSS in debug SQL output 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-10-17 18:07:08 +05:30
Marc Delisle
5118938f10 4.0.10.4 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-10-01 07:20:09 -04:00
Marc Delisle
c6c77589a5 [security] XSS with malicious ENUM values 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-09-28 09:48:13 -04:00
Marc Delisle
ceb7d7e1b2 4.0.10.3 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-09-13 11:12:44 -04:00
Marc Delisle
ab0dba4533 bug #4530 [security] DOM based XSS that results to a CSRF that creates a ROOT account in certain conditions 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-09-12 08:22:14 -04:00
Marc Delisle
5e52612841 4.0.10.2 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-08-17 06:59:44 -04:00
Marc Delisle
f86761326c 4.0.10.1 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-07-17 17:35:22 -04:00
Madhura Jayaratne
1b55924356 bug #4488 [security] XSS injection due to unescaped table name (triggers) 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-07-17 16:29:40 -04:00
Marc Delisle
82161a6c30 4.0.10 release 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2013-12-04 12:36:40 -05:00
Michal Čihař
c8c4311567 Another missing query 
Signed-off-by: Michal Čihař <mcihar@suse.cz>
 2013-12-04 10:47:30 +01:00
Michal Čihař
729603286a Add missing comma 
Signed-off-by: Michal Čihař <mcihar@suse.cz>
 2013-12-04 10:35:05 +01:00
Michal Čihař
1580d0f77a Another missing query 2013-12-04 10:10:39 +01:00
Michal Čihař
4a5d2e0720 Fixed test queries 2013-12-04 09:22:40 +01:00
Marc Delisle
b22b76e7f5 bug #4158 Events page says no privileges with ALL PRIVILEGES 2013-11-27 12:36:51 -05:00